Skip to content

Azure.Storage.LocalAuth.md

Latest commit

 

History

History
106 lines (82 loc) · 3.41 KB

Azure.Storage.LocalAuth.md

File metadata and controls

106 lines (82 loc) · 3.41 KB
Raw
severity Important
pillar Security
category SE:05 Identity and access management
resource Storage Account
resourceType Microsoft.Storage/storageAccounts
online version https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Storage.LocalAuth/

Storage account access keys are enabled

SYNOPSIS

Access keys allow depersonalized access to Storage Accounts using a shared secret.

DESCRIPTION

Every request to a Storage Account resource must be authenticated. Storage Accounts support authenticating requests using either Entra ID (previously Azure AD) identities or local authentication. Local authentication uses access keys and SAS tokens that are granted permissions to the entire Storage Account.

Using Entra ID provides consistency as a single authoritative source which:

  • Increases clarity and reduces security risks from human errors and configuration complexity.
  • Allows granting of permissions using role-based access control (RBAC).
  • Provides support for advanced identity security and governance features.

Disabling local authentication ensures that Entra ID is used exclusively for authentication. Any subsequent requests to the resource using access keys or SAS tokens will be rejected.

RECOMMENDATION

Consider disabling local authentication on Storage Accounts and instead use Entra ID.

EXAMPLES

Configure with Bicep

To deploy Storage Accounts that pass this rule:

  • Set the properties.allowSharedKeyAccess property to false.

For example:

resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: name
  location: location
  sku: {
    name: 'Standard_GRS'
  }
  kind: 'StorageV2'
  properties: {
    allowBlobPublicAccess: false
    supportsHttpsTrafficOnly: true
    minimumTlsVersion: 'TLS1_2'
    accessTier: 'Hot'
    allowSharedKeyAccess: false
    networkAcls: {
      defaultAction: 'Deny'
    }
  }
}

Configure with Azure template

To deploy Storage Accounts that pass this rule:

  • Set the properties.allowSharedKeyAccess property to false.

For example:

{
  "type": "Microsoft.Storage/storageAccounts",
  "apiVersion": "2023-01-01",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "sku": {
    "name": "Standard_GRS"
  },
  "kind": "StorageV2",
  "properties": {
    "allowBlobPublicAccess": false,
    "supportsHttpsTrafficOnly": true,
    "minimumTlsVersion": "TLS1_2",
    "accessTier": "Hot",
    "allowSharedKeyAccess": false,
    "networkAcls": {
      "defaultAction": "Deny"
    }
  }
}

LINKS